Data Aggregation

Under Retina's hood, data are communicate between plugins and the control plane via Flow objects. Retina's data aggregation settings are designed to manage the amount of data that can be potentially generate by the agent .i.e the number of flows being generated. At a higher aggregation level, fewer flows objects are produced, which ensures resource efficiency in large clusters. Conversely, a lower level of aggregation results in more flow objects being generated, offering more detailed information regarding packets being observed at different points in the Linux kernel.The operational behaviors of Retina at each aggregation level are detailed in the table below:

Level Description

low packetparser will attach a bpf program to the node's default interface in the node namespace, which will help capture events for TO_NETWORK and FROM_NETWORK packets. This will give users a more granular view of packet flows and offers more reliable apiserver latency metrics.

high packetparser will not attach a bpf program to the node's default interface in the node namespace. As a result, packet observation at this location will be disabled, leading to a reduction in events being generated. This configuration is recommended when scalability is the primary concern. However, it is important to note that, due to the absence of packet observation at the default interface, the apiserver latency metrics may not be as reliable.

Level	Description
`low`	`packetparser` will attach a bpf program to the node's default interface in the node namespace, which will help capture events for `TO_NETWORK` and `FROM_NETWORK` packets. This will give users a more granular view of packet flows and offers more reliable apiserver latency metrics.
`high`	`packetparser` will not attach a bpf program to the node's default interface in the node namespace. As a result, packet observation at this location will be disabled, leading to a reduction in events being generated. This configuration is recommended when scalability is the primary concern. However, it is important to note that, due to the absence of packet observation at the default interface, the apiserver latency metrics may not be as reliable.